On Mon, Jan 12, 2009 at 2:22 PM, Aaron Schaefer <aaron@xxxxxxxxxxxxxx> wrote: > Once that patch gets pushed to the public, what do people think about > switching over to sha256 as a default instead of md5 due to potential > collision/security issues? Haven't we been over this like a hundred times? md5sums are not used for security. Not ever. Nope. Nada. We use them solely to detect whether or not the download completed as expected. And sha256 is going way overboard here.
